White hats outrun Coldcard hackers in 52-Bitcoin evacuation

White-hat security researchers transferred 52.37 BTC they recovered from wallets affected by a Coldcard vulnerability to a Wyoming-based Crypto Recovery Trust, according to Galaxy Digital researcher Alex Thorn. The rescued funds represent roughly 40% of Bitcoin moved in the exploit's second wave, and victims can check whether the trust controls their addresses on the trust's website.

By AI Newsroom· Reviewed by Pranav, Founder & Editor-in-ChiefPublished about 2 hours agoUpdated about 2 hours ago0 views

White hats outrun Coldcard hackers in 52-Bitcoin evacuation

Why It Matters

The operation redirected a significant portion of at-risk funds into a vehicle intended to return assets to victims, limiting the opportunity for attackers to steal the coins. With thousands of addresses linked to the Coldcard flaw, coordinated recovery efforts could materially affect how much of the exposed supply is ultimately lost or reclaimed.

Key Facts

Amount moved to Crypto Recovery Trust: 52.37 BTC
Organization controlling receiving address: Wyoming-based Crypto Recovery Trust
Source reporting the transfer: Alex Thorn, head of research at Galaxy Digital (X post)
Share of second-wave Bitcoin swept by white hats: About 40%
Untracked funds included in transfer: 3.0134 BTC from addresses Galaxy had not previously tracked

White-hat security researchers have moved 52.37 Bitcoin recovered from wallets exposed by a Coldcard hardware-wallet vulnerability into an address controlled by Crypto Recovery Trust, a Wyoming-based entity, Galaxy Digital researcher Alex Thorn said in a post on X. Thorn said the recovered coins amount to roughly 40% of the Bitcoin associated with the exploit's second wave.

Thorn noted that 3.0134 BTC included in the transfer originated from addresses Galaxy Digital had not tracked before, which he said were likely also rescued from wallets affected by the Coldcard flaw, though Galaxy could not independently verify their provenance. The transfer followed earlier rescue efforts: security researcher and SEAL 911 incident responder Nick Bax said on Sept. 9 that he helped secure about 50 BTC at the end of July because those funds were in immediate danger of being taken due to an entropy flaw in Coldcard devices.

A published tally cited by Thorn lists 1,830 BTC across 9,162 addresses as linked to the Coldcard vulnerability. The Crypto Recovery Trust has set up a portal where potential victims can enter wallet addresses to see whether the trust controls the funds recovered from affected wallets.

Thorn did not immediately respond to Cointelegraph's request for comment. The moves by white hats redirected a portion of at-risk funds away from attackers and into a recovery vehicle intended to return assets to their rightful owners, according to the information provided by Galaxy Digital and responders involved in the rescues.